dsh-plugin-updater

English | 简体中文

Package-level plugin manager with update detection for
DeepSeek Harness (DSH).

It adds a Settings → 插件包 page to the DSH web UI that lists every plugin
package installed in the current profile, shows the installed version and
the latest available one, and can install, update, and remove packages —
dsh plugin (a thin pnpm forwarder) with a browser UI.

This is a community plugin, not an official DeepSeek package. It manages the
install state of a profile (npm packages and the dsh.profile.bundles layer
list); for runtime enable/disable of loader entries see
dsh-plugin-manager
— the two are complementary.

Features

• Lists every dependency of the current profile with its installed version,
  source (npm / Git / local / built-in), and whether it is an active bundle
  layer (dsh.profile.bundles).
• Update detection per source:
  • npm — installed version vs pnpm view <name> dist-tags (runs inside
    the profile directory, so the configured registry and credentials apply).
  • Git (github:owner/repo, git+…, …#ref) — the installed commit
    (from the profile lockfile) vs git ls-remote <url> <ref>; the newest
    semver tag is displayed as the latest version when the repo has tags.
  • Local (link: / file:) — the checkout's local HEAD vs
    git ls-remote origin HEAD, so "the repo moved on" is visible without
    reinstalling.
  • Built-in @deepseek-ai/* bundles — version shown, updated together
    with the dsh installation.
• One-click install (any pnpm spec), update (<name>@latest for npm,
  re-fetch of the recorded spec for Git), and remove, each running
  pnpm add/remove in the profile directory followed by the same bundle
  reconciliation dsh plugin performs (a dependency resolving to a package
  that declares dsh.bundle.patch joins the layer list; a removed one leaves).
• 插件市场 (marketplace) — searches GitHub for repositories carrying the
  dsh-plugin topic (forks excluded),
  sortable by relevance / stars / last push, with pagination, and installs any
  result directly as a github:owner/repo dependency. Repos already present
  in the profile are badged 已安装. Results are cached ~5 min; set
  DSH_GITHUB_TOKEN (or GITHUB_TOKEN / GH_TOKEN) to raise GitHub's
  unauthenticated search quota.
• Live operation log and an explicit "restart dsh to apply" banner — profile
  layers are composed at boot, so changes take effect after a restart.
• Check results are cached (~10 min) in ~/.dsh/plugin-updater.json; no
  background polling of registries.

Install

dsh plugin --profile web add github:hyqhyq3/dsh-plugin-updater
dsh --profile web   # restart, then open Settings → 插件包

Or from a local checkout:

dsh plugin --profile web add link:/path/to/dsh-plugin-updater

How it works

• Host half lib/index.js — discovers the profile it is installed in
  (the profile whose node_modules/dsh-plugin-updater realpaths to its own
  package directory; override with DSH_PLUGIN_UPDATER_PROFILE), reads the
  install state (package.json, node_modules/*/package.json,
  pnpm-lock.yaml), runs update checks (pnpm view, git ls-remote), and
  exposes a same-origin JSON API at /plugin-updater/api/* on the GUI
  webserver. Mutations spawn pnpm in the profile directory and re-apply the
  bundle reconciliation.
• Client half lib/client.js — a hand-written module factory registering
  the Settings section; polls /api/state every 3 s. UI strings are
  Simplified Chinese.

HTTP API:

Plain ESM JavaScript, zero dependencies (Node built-ins only; Node
^22.19 || >=24, pnpm on PATH, git for Git update checks). No build step —
lib/*.js ships exactly as written.

Limitations

• Changes require a dsh restart to take effect (this page shows the banner);
  the running process is never reloaded implicitly.
• The manager refuses to remove itself from the page — use
  dsh plugin --profile <name> remove dsh-plugin-updater.
• Update detection for Git packages pins to the spec's ref (#ref or the
  default branch HEAD); a moved tag is not treated as an update.
• A link: install without a .git target is listed but not checked.
• Marketplace search uses GitHub's public search API: without a token it is
  limited to 10 requests/min (results are cached ~5 min to stretch that);
  DSH_GITHUB_TOKEN raises the quota.
• Only dependencies of the profile manifest are managed; runtime loader
  rows (enable/disable) are out of scope.

Model Experience

None. This plugin adds no model-facing surfaces: it registers no tools and
injects no prompt context; it only serves the Settings page and its JSON API.

License

MIT